Is DNS the problem? Did you do a proper analyses on why it takes a long time?

In such a case I like to use the Developer Tools (F12) which can give you a good indication on where the problem is.

From your config:

Code: Select all

/ip dhcp-client
add interface=ether8-WAN

You can expand that with use-peer-dns=no to make sure only the /ip dns configured DNS servers are used.

If you are an ISP ...
Using external DNS servers ( such as in your case 1.1.1.1 & 8.8.8.8 ) might not deliver fast/quick DNS results.

Some issues/problems when using any external ( not yours ) may include some or all of the following potential problems :
- Network propagation delays ; The time and hops it takes for a client on your network to make a DNS request and have that DNS request traverse your networks , through any of your firewalls & routers , then out through your Internet connection , then out through your upstream ISPs Internet connection , then through the Internet BGP routers , then finally the DNS request making it to an external DNS server.
- After an external DNS server receives your clients DNS query , that server could be very busy processing other DNS queries ( tens-of-thousands + ) which can delay that external DNS server and the time it takes to generate/send the answer to your clients DNS request.
- Packets sent from an external DNS server back to your customer's DNS query may experience similar delays/propagation delays as the returned DNS answer traverses from it's location , through all the Internet BGP servers , through your ISPs upstream Internet connection , through your Internet connection , then through your clients firewalls/routers and finally to the original computer that made the DNS request.

As is ISP with thousands of customers , I never assign any of my clients external off-site DNS servers. It is just way toooo slow to get results.
I maintain my own dedicated Linux BIND DNS servers. My DNS servers respond to my customer DNS queries very quickly , mostly because there my DNS servers are very close to my customers - very little propagation delay - and my DNS servers are not also processing tens-of-thousands of DNS queries from other locations out on the Internet. Typical customer ping time to my DNS servers is always under 5-ms or quicker.

North Idaho Tom Jones

I maintain my own dedicated Linux BIND DNS servers.
North Idaho Tom Jones

I maintain my own dedicated Linux BIND DNS servers.
North Idaho Tom Jones

Are these servers authoritative?

Authoritativity of servers depends on whether they are declared (by SOA and NS records) as such for certain domain(s). All other servers are caching servers. Like DNS server at 8.8.8.8 is caching server for mikrotik.com ... and servers of @TomjNorthIdaho are exactly the same in tthis respect.

Authoritativity of servers depends on whether they are declared (by SOA and NS records) as such for certain domain(s). All other servers are caching servers. Like DNS server at 8.8.8.8 is caching server for mikrotik.com ... and servers of @TomjNorthIdaho are exactly the same in tthis respect.

So a query that isn't already cached must leave his network and the response time will be slower. I'm curious about the 5ms response time.

Yes. But if he has many clients using his caching servers, chance is that answer is cached already. If it's not, then answer to your query will be cached and ready fir anotger user asking same question. So some queries will go out to the wild, possibly traversing all DNS hierarchy from the root servers down, but not all. And, BTW, also google or cloudflare servers have to do the same.

any help to setup my own dns server?

any help to setup my own dns server?

any help to setup my own dns server?

How many clients(computers) do you hope to serve?

any help to setup my own dns server?

Please first confirm your problem, is it DNS?

What is the exact purpose of running your own DNS server?

Do any ISPs still use squid proxy/cache servers ?

Code: Select all

...
/ip firewall filter
add action=drop chain=forward connection-state=new dst-address=10.80.81.0/24 \
    src-address=192.168.27.0/24
add action=accept chain=input comment="allow WireGuard" dst-port=31231 \
    protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" src-address=\
    10.6.14.0/24
add action=accept chain=input connection-state=established,related
add action=accept chain=input src-address-list="rede suporte"
add action=accept chain=input limit=50,5:packet protocol=icmp
add action=add-src-to-address-list address-list="rede suporte" \
    address-list-timeout=5h chain=input dst-port=1981 protocol=tcp
add action=drop chain=input
add action=fasttrack-connection chain=forward comment="Fasttrack TCP" \
    dst-port=53 hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward comment="Fasttrack UDP" \
    dst-port=53 hw-offload=yes protocol=udp

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether8-WAN
add action=dst-nat chain=dstnat dst-port=8000 protocol=tcp to-addresses=\
    10.80.81.3 to-ports=8000
add action=dst-nat chain=dstnat dst-port=8001 protocol=tcp to-addresses=\
    10.80.81.4 to-ports=8000
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=\
    10.80.81.5 to-ports=80
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=\
    10.80.81.5 to-ports=8001
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=\
    10.80.81.5 to-ports=8000
...